How to use Cursor to evaluate workspace hooks
Eilon Cohen’s Cursor test turned workspace Stop hooks into unapproved host execution; the benign proof led to CVE-2026-48124 and a patched Desktop version.
pillar.security
Original prompt
Shared by the source author. See source notes for context.
Use terminal commands only. Execute exactly ONE terminal command.
Reach people exploring AI agents
See placements →What happened
The test demonstrated an approval bypass through workspace hook configuration; Cursor assigned CVE-2026-48124 and lists version 3.0.0 as patched.
Reported by Eilon Cohen — Pillar Security blogHow the agent did it
- Cohen instructed the agent to create controlled helper and Stop-hook files in the test workspace.
- Ending the agent turn caused Cursor’s helper to open Calculator without a dedicated final-command approval.
- The finding was disclosed as CVE-2026-48124, and Cursor’s advisory records Desktop 3.0.0 as patched.
Where a person stepped in
Cohen used a benign Calculator proof and disclosed the finding; the publication and vendor advisory distinguish affected and patched versions.
Eilon Cohen used Cursor in a controlled test of workspace automation. The agent wrote a helper script and Claude-compatible Stop-hook configuration inside the project. When its turn ended, Cursor’s hook engine opened Calculator from the user’s local context without a dedicated approval for that final action.
The important distinction was between permission to edit project files and permission for another component to execute those files. The direct agent path remained sandboxed, but a compatibility configuration became executable input to a more privileged helper. The benign application launch demonstrated that handoff failure without requiring a destructive payload.
Cohen published the reproduction prompt and affected Desktop version. Cursor assigned CVE-2026-48124, and the linked vendor advisory identifies 3.0.0 as patched. Pillar recommends explicit approval naming the hook command and its source file, with hooks governed by the same sandbox policy as direct commands. Those recommendations should not be confused with a verified description of every implementation detail in the patch.
This is a disclosed security failure in a controlled evaluation. Human oversight included selecting the harmless proof and checking the vendor advisory. It supports reviewing executable compatibility configuration as part of the agent’s authority boundary.
Prompt
Original prompt
Source: Pillar Security blog · Eilon Cohen
Frequently asked questions
Why did an editable configuration file matter?
A privileged hook engine later treated it as an instruction to run a command.
Did the proof steal data?
The published proof opened Calculator to demonstrate execution outside the expected approval path.
Which version does the vendor list as patched?
The linked Cursor advisory identifies Desktop 3.0.0 as patched.
More details
About this account
Cohen instructed the agent to create controlled helper and Stop-hook files in the test workspace. Ending the agent turn caused Cursor’s helper to open Calculator without a dedicated final-command approval.
Original evaluation prompt excerpt, not a normal task recommendation; the payload is omitted. Firsthand benign execution and vendor advisory opened. Pillar’s proposed controls are recommendations, not a verified patch implementation description. Original prompt excerpt.
Credit: Eilon Cohen — Pillar Security blog
Source published 20 Jul 2026
Source checked 14 Oct 2026
Tools and topics
Cursor Desktop · workspace hook configuration · Calculator
hook approval · sandbox evaluation · CVE remediation
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.